GDPR consent text for web forms

Fill in your business details and get the key data protection information to show next to your form, with the consent checkboxes, in HTML ready to paste.

GDPR first layerIn your browser

Preview

For Elementor Forms

A starting text, not legal advice. Review it with whoever handles data protection for your business.

How to generate your form’s GDPR text

01

Fill in your details

Who the controller is, what you use the data for, who you share it with and where your privacy policy lives.

02

Review the text

It follows the headings of the layered “basic information” model used by EU data protection authorities. The preview updates as you type; adjust it to your case.

03

Paste it into the form

Copy the full HTML or, in Elementor Forms, the notice into an HTML field above the button and each checkbox into an acceptance field.

What the form consent text includes

The six first-layer headings

Controller, purpose, legal basis, recipients, rights and further information, with the link to your privacy policy. It is the key information shown next to the form, with the details in the policy.

The legal basis that fits

A general enquiry relies on consent; a quote or a booking on the person’s own request (Art. 6(1)(b) GDPR). The tool picks the right one for the purpose you choose.

Unticked checkboxes

The consent checkbox is required and unticked. If you add marketing emails, they get a separate, optional checkbox, because that purpose needs its own consent.

Elementor Forms version

Besides the full HTML, you get the notice for an HTML field and the sentences for the acceptance fields, which is how it is built in an Elementor form.

What GDPR consent on a form should look like

Information is given in layers: the key points next to the form, the detail in the privacy policy. EU data protection authorities recommend this layered approach.

  • The checkbox can’t be pre-ticked: consent must be a clear action by the person (Art. 4(11) GDPR and Recital 32).
  • One purpose, one checkbox: agreeing to the policy so you can reply is not agreeing to marketing.
  • No conditions: you can’t require marketing consent to answer an enquiry.
  • Ask only for what you need: for an enquiry, name, email and message are usually enough (data minimisation, Art. 5(1)(c) GDPR).
  • You must be able to prove it: the controller has to be able to show the person consented (Art. 7(1) GDPR).
Plugin no. 5Coming soon

What about proving the user agreed?

The text informs; it leaves no record. The GDPR forms plugin adds it to all your forms and stores what each person agreed to and when.

GDPR forms · Coming soon

What this tool doesn't do

  • It isn’t legal advice: it is a starting text to review with whoever handles data protection for your business.
  • It doesn’t store proof of consent: that depends on how your site records submissions.
  • It doesn’t cover cookies, international transfers or automated decisions; if you have them, the notice must mention them.
  • It is built on the Spanish layered model (GDPR plus Spain’s LOPDGDD); outside Spain, check your country’s rules and authority.

GDPR form text: frequently asked questions

Is this legal advice?

No. It is a starting text with the usual first-layer structure. Review it with whoever handles data protection for your business.

Can the checkbox be pre-ticked?

No. Consent must be a clear action by the user; a pre-ticked box is not valid consent (Art. 4(11) GDPR and Recital 32).

Do I need two checkboxes?

If you also want to send marketing emails, yes: that purpose needs its own consent and can’t be a condition for answering the enquiry.

What data should a form ask for?

Only what the purpose needs. For an enquiry, name, email and message are usually enough; a phone number only if you will actually call.

Where does the text go in Elementor?

In the form, add an HTML field above the submit button with the key information, and a required acceptance field with the checkbox sentence.